Cyber Use Case Developer (Cybersecurity)

TL;DR

Cyber Use Case Developer (Cybersecurity): Designing and developing security monitoring use cases to detect threats and policy violations across enterprise environments with an accent on detection logic and high-quality alerting. Focus on translating adversary tactics into actionable SIEM/EDR rules, reducing false positives, and mapping detections to the MITRE ATT&CK framework.

Location: Hybrid (Toronto, Ontario). Requires Reliability Status Clearance from the Government of Canada.

Salary: 65,000 - 105,000 CAD

Company

A leading global financial services organization focused on helping clients achieve lifetime financial security and healthier lives.

What you will do

• Develop and maintain cybersecurity detection use cases across SIEM, EDR, XDR, and cloud data sources.
• Translate adversary tactics and techniques into detection logic aligned with the MITRE ATT&CK framework.
• Write, test, and tune detection rules, search queries, and alert logic to ensure high-fidelity alerts.
• Manage the full use case lifecycle from requirements gathering and design to deployment and retirement.
• Collaborate with Threat Hunting and Intelligence teams to operationalize findings into permanent detections.
• Conduct false-positive analysis and track performance through metrics such as true-positive rate and mean time to detect.

Requirements

• Post-secondary education in Cyber Security, IT, Computer Science, or equivalent practical experience.
• Experience in SOC, detection engineering, threat hunting, or incident response.
• Hands-on proficiency with SIEM, EDR, XDR, or cloud security telemetry.
• Ability to write search queries using languages such as SPL, KQL, SQL, Sigma, YARA, Python, or PowerShell.
• Strong understanding of attacker behaviors (persistence, lateral movement, etc.) and security frameworks like MITRE ATT&CK or NIST.
• Must be eligible for Reliability Status Clearance (Government of Canada), including law enforcement and credit checks.

Culture & Benefits

• Hybrid work model offering flexibility to work from both the office and virtually.
• Inclusive environment that values diversity and wide perspectives.
• Access to professional growth opportunities and empowering leadership.
• Participation in various incentive plans based on individual and company performance.